Hello @lrader, Can you take a look at this Splunk documentation? https://docs.splunk.com/Documentation/Splunk/9.4.2/Security/ConfigureSSOPing Hope this helps! ... View more

Hi @yigaloz, What helped me identify errors in the configuration of this addon was enabling debug logging by editing the file $SPLUNK_HOME/etc/apps/TA-oci-logging-addon/bin/oci_logging.py, changing the string ERROR to DEBUG on line 42. Then restart Splunk. You can check the logs using the query: index=_internal source=*oci_logging.log Another possibility would be to install a previous version of the addon, which might work. ... View more

Hey @vh, Quite strange behavior. Here I'm using version 1.0.23 of the add-on and 9.2.4 of Splunk Enterprise. You could try installing an earlier version of the add-on, it might work. On Splunkbase, the last version that supports only Splunk Enterprise is 1.0.24, that's a good version to try As a last resort, you could have only the heavy forwarder running version 9.2.3 of Splunk with the add-on installed. It would work, but it's not ideal. Let me know if it works ... View more

Hello @vh , It took some work, but I finally got this addon up and running. On the addon's setup screen, you need to paste the contents of the certificate and the private key generated in the CyberArk console. The certificate and private key contents are in the following format: -----BEGIN%20CERTIFICATE-----xxxxxxxxxxxxxxxxxx-----END%20CERTIFICATE-----%0A To generate the necessary information in the CyberArk console, follow the procedure available at the following link: https://docs.cyberark.com/admin-space/latest/en/content/siem-integration/siem-export-splunk.htm After the setup, you can create the input at Settings > Data Input > CyberArk Audit for Splunk, filling in the fields with the data generated in the CyberArk console. You can monitor the addon's operation through the logs available at: index=_internal source="*splunkd.log" cyberark If you need to redo the addon's setup, you can do so by clicking the "Setup" link under Apps > Manage Apps. ... View more

Hi @vvkarur  You can use the rex field, like this example. | rex field=_raw "\"role\"\:\"(?<role>[^,\"]+)\""   ... View more

Hi @danielbb  I used the TA below for a long time and it worked well. https://splunkbase.splunk.com/app/4060  ... View more

Hi @Dk123  Do you see other kvstore errors in splunkd.log and mongod.log? ... View more

Hi @Karthikeya  It could be access permission to the extracted field. Go to the menu Settings > Fields, click on Field Extractions, and check if the permission for your field is correct. To ensure access for all users, set the app permissions to global and the Role permissions to Read for Everyone. ... View more

Hi @Dikshi, Do you see other kvstore errors in splunkd.log and mongod.log? ... View more

Hi @devsru, You can use makeresults for that: | makeresults | eval msg="Daylight savings is scheduled tomorrow, please be alerted " | fields - _time Create an cron scheduled alert based on this SPL, triggering when the results are more than 0, and configure the 'Send Email' alert action. ... View more

Right! If you have only one indexer ... View more

Hi @Dawoo, how are you? You can follow the documentation steps to install UF on MacOS ... View more

@user487596, an easier way to manipulate passwords is by using the Splunkbase app: https://splunkbase.splunk.com/app/4013 ... View more

Hey @user487596, how are you? You can use REST API endpoints, like this example using curl locally on your Splunk instance:   curl -k -u <username>:<password> \ https://localhost:8089/servicesNS/nobody/<app>/storage/passwords \ -d name=user1 -d realm=realm1 -d password=password1     In your code, use a prepare method to retrieve your key:   def prepare(self): global API_KEY for passwd in self.service.storage_passwords: if passwd.realm == "<you_realm_key>": API_KEY = passwd.clear_password if API_KEY is None or API_KEY == "defaults_empty": self.error_exit(None, "No API key found.")     Documentation can be found here  ... View more

Hello @Pastea, You can try this https://community.splunk.com/t5/All-Apps-and-Add-ons/Addon-Builder-Configuration-Pages-Don-t-Work-on-a-Search-Head/m-p/679681/thread-id/80304 ... View more

Hello @cameronjust , You can use a setting in the server.conf called conf_replication_include to force the replication of the file containing the accounts. https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Serverconf After creating an account, the account_file is created in the local folder of your app. Example: [shclustering] conf_replication_include.<app_account_file_without_extension> = true ... View more